reset the failed container unit before stopping it in the link-refusal vm subtest

nix/vm-tests/agent-ephemeral-rootfs.nix

@@ -254,8 +254,10 @@ pkgs.testers.runNixOSTest {
         host.succeed(f"test -L {ROOT}/root")
 
         # Control: with the link gone the same unit starts.
-        host.succeed(f"systemctl stop container@{MACHINE}")
+        # The reset comes first: once the failed unit is stopped, systemd
+        # unloads it and reset-failed exits 1.
         host.succeed(f"systemctl reset-failed container@{MACHINE}")
+        host.succeed(f"systemctl stop container@{MACHINE}")
         host.succeed(f"rm {ROOT}/root && mkdir -m 0700 {ROOT}/root")
         boot()
   '';